{"action":"Upgrade com.capacitorjs:core to 6.2.2 (6.2.x), 7.6.9 (7.6.x), 8.4.3 (8.4.x) or 8.5.1 (8.5.x) or later.","affected":[{"fixed":"6.2.2","introduced":"6.0.0"},{"fixed":"7.6.9","introduced":"7.0.0"},{"fixed":"8.5.1","introduced":"8.5.0"},{"fixed":"8.4.3","introduced":"8.3.5"},{"introduced":"8.0.0","last_affected":"8.3.4"}],"component":"com.capacitorjs:core","cve_ids":["CVE-2026-103922"],"ecosystem":"Maven","epss":0.0034,"exploited":false,"fixed_versions":["6.2.2","7.6.9","8.5.1","8.4.3"],"ghsa_id":"GHSA-rvm3-566m-v7fv","id":"tcs_01M5N9CMZCCXBDSHH7JTPVBCM0","modified_at":"2026-10-05T23:00:05.499076955Z","published_at":"2026-10-05T22:53:10Z","references":["https://osv.dev/vulnerability/GHSA-rvm3-566m-v7fv","https://github.com/ionic-team/capacitor/security/advisories/GHSA-rvm3-566m-v7fv","https://nvd.nist.gov/vuln/detail/CVE-2026-103922","https://github.com/ionic-team/capacitor/commit/430356a91e1419fc66862dc09835081aa501677e","https://github.com/ionic-team/capacitor/commit/745b5f805bf77bc6463977cc7d718cd9de44ccbc","https://github.com/ionic-team/capacitor/commit/80b6c5e81d062e1e158914040f49e044d95b7ccb","https://github.com/ionic-team/capacitor/commit/85ccc44151fdd5ae5e0d806d875766ef4b84ad5d","https://github.com/ionic-team/capacitor/commit/af9a287fef45f0ac68ce640cb42fed2d06b0f1b4","https://github.com/ionic-team/capacitor/commit/d5e3170ba0ff155fc542b7e6d16cff5201406540","https://github.com/ionic-team/capacitor/commit/ee586ae680887ba99d066616f976db149542d922","https://github.com/ionic-team/capacitor","https://github.com/ionic-team/capacitor/releases/tag/8.5.1"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-rvm3-566m-v7fv#Maven/com.capacitorjs:core","url":"https://osv.dev/vulnerability/GHSA-rvm3-566m-v7fv"}],"summary":"Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path"}